CVE-2022-3419CWE-269CWE-352

Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation

Medium · published October 31, 2022

CVSS v3.1
6.5
EPSS
0%
Percentile
29.0
In the wild
Unconfirmed
What it is

The Automatic User Roles Switcher WordPress plugin before 1.1.2 does not have authorisation and proper CSRF checks, allowing any authenticated users like subscriber to add any role to themselves, such as administrator

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.0th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2022-10-31T00:00Z
EPSS history
Timeline
  • 31 OCT 00:00Z
    Automatic User Roles Switcher < 1.1.2 - Subscriber+ Privilege Escalation
    cvelistv5